Peoplesoft Enterprise Cc Common Application Objects CVE-2026-60606

A critical authentication bypass in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows unauthenticated remote attackers to read, modify, and delete critical business data over HTTP. Any organization running this version with network exposure faces immediate risk of unauthorized data access or destruction without user action or credentials. No patch is currently available, requiring urgent compensating controls.

Within 24 hours: Inventory all Oracle PeopleSoft Enterprise CC 9.2 instances and assess internet exposure; immediately implement network-level restrictions to limit HTTP/HTTPS access to trusted internal networks and authorized users only. Within 7 days: Deploy web application firewall rules to detect and block exploitation attempts against PeopleSoft endpoints; enable enhanced logging and alerting for data access anomalies. Within 30 days: Establish regular communication with Oracle to track patch availability timelines; develop and test a migration or upgrade plan for all affected PeopleSoft 9.2 systems, prioritizing internet-facing deployments.

Network segmentation is critical: restrict PeopleSoft 9.2 application access exclusively to trusted internal networks and remove any direct internet exposure. Deploy a web application firewall (WAF) with signatures to detect and block exploitation patterns targeting authentication endpoints. Implement mandatory IP whitelisting for all remote access and enforce multi-factor authentication on any administrative or privileged access to PeopleSoft instances. Enable continuous monitoring and alerting for suspicious data read, create, modify, or delete operations.